{"id":3421,"date":"2026-08-12T14:57:21","date_gmt":"2026-08-12T13:57:21","guid":{"rendered":"https:\/\/icomply.pm\/controls-mapping\/"},"modified":"2026-08-16T22:52:38","modified_gmt":"2026-08-16T21:52:38","slug":"controls-mapping","status":"publish","type":"page","link":"https:\/\/icomply.pt\/en\/documentation\/controls-mapping\/","title":{"rendered":"Controls &#038; Mapping"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3421\" class=\"elementor elementor-3421 elementor-3178\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-17cd6e4 e-flex e-con-boxed e-con e-parent\" data-id=\"17cd6e4\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-48e0fb3 e-con-full e-flex e-con e-child\" data-id=\"48e0fb3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5bc1296 elementor-icon-list--layout-inline elementor-align-start elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"5bc1296\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"\/\">\n\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Documentation<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">\/<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><span style=\"color: #c3ccd8\">Controls &amp; mapping<\/span><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b1cafec elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"b1cafec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-circle\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8C119 8 8 119 8 256s111 248 248 248 248-111 248-248S393 8 256 8z\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Key concept \u00b7 14 mins<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-80a09be elementor-widget__width-initial elementor-widget elementor-widget-image-box\" data-id=\"80a09be\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Controls &amp; mapping<\/div><p class=\"elementor-image-box-description\">Map a control once and reuse it across all frameworks. This is the concept that sets iComply apart from any checklist \u2014 it\u2019s worth understanding it properly. \n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-69c57ed e-flex e-con-boxed e-con e-parent\" data-id=\"69c57ed\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9b79d9b content_34535345 elementor-widget elementor-widget-text-editor\" data-id=\"9b79d9b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"icbody\" style=\"min-width: 0;\"><p>Most compliance tools organise work by <em>framework<\/em>: one list for ISO 27001, another for the GDPR, and another for NIS2. The result is work being duplicated three times over and evidence scattered across different systems. iComply turns this model on its head: it organises by <strong>control<\/strong>, and the frameworks are then viewed in relation to those same controls.  <\/p><h2 id=\"modelo\">The data model<\/h2><p>Four objects and the relationships between them underpin everything else:<\/p><ul><li><strong>Requirement<\/strong> \u2014 a specific clause in a standard or law (e.g. ISO 27001 A.5.17, GDPR Art. 32, NIS2 Art. 21).<\/li><li><strong>Controlo<\/strong> \u2014 a medida operacional que a organiza\u00e7\u00e3o implementa (ex. &#8220;MFA imposta em todos os acessos remotos&#8221;).<\/li><li><strong>Risk<\/strong> \u2014 what controls mitigate, including probability, impact and risk appetite.<\/li><li><strong>Evidence <\/strong>\u2014 documentary proof that the control is working.<\/li><\/ul><p>The relationships are many-to-many: one control meets several requirements, one requirement may call for several controls, and one piece of evidence may support several controls. It is this topology that eliminates duplication. <\/p><h2 id=\"exemplo\">A concrete example<\/h2><p>Consider the \u2018<strong>Mandatory multi-factor authentication<\/strong>\u2019 control. Once implemented and with supporting evidence attached, it simultaneously satisfies: <\/p><ul><li><strong>ISO 27001<\/strong> \u2014 A.5.17 (authentication information)<\/li><li><strong>NIS2 <\/strong>\u2014 Article 21 (risk management measures)<\/li><li><strong>DORA<\/strong> \u2014 ICT risk management requirements<\/li><li><strong>SOC 2 <\/strong>\u2014 CC6.1 (logical access controls)<\/li><li><strong>GDPR <\/strong>\u2014 Article 32 (security of processing)<\/li><li><strong>CIS Controls<\/strong> \u2014 Control 6 (access management)<\/li><\/ul><p>With a framework-based tool, you\u2019d have to answer the same question six times and upload the same evidence six times. Here, you only have to answer it once. <\/p><h2 id=\"estados\">States of a control<\/h2><p>Each control has a status that feeds directly into the dashboard and reports:<\/p><ul><li><strong>Not started <\/strong>\u2014 identified but not yet working.<\/li><li><strong>Under implementation<\/strong> \u2014 work in progress, with a designated person and a deadline.<\/li><li><strong>Implemented <\/strong>\u2014 operational, with valid supporting evidence attached.<\/li><li><strong>Under review <\/strong>\u2014 has reached the review milestone and is awaiting validation.<\/li><li><strong>Non-compliant<\/strong> \u2014 failed a test or audit; automatically triggers a CAPA action.<\/li><li><strong>Not applicable<\/strong> \u2014 outside the scope, with justification recorded for the auditor.<\/li><\/ul><h2 id=\"mapear\">How to map a control<\/h2><ol><li>Open <code>Controlos \u2192 Biblioteca<\/code> and select the control.<\/li><li>On the \u2018<strong>Mapping<\/strong>\u2019 tab, view the requirements already mapped by the frameworks\u2019 official libraries.<\/li><li>Add manual mappings where your specific circumstances require it \u2014 for example, a requirement under national legislation.<\/li><li>Rate the <strong>strength of the mapping<\/strong>: fully satisfies, partially satisfies, or contributes. A requirement that is only partially satisfied will continue to appear as incomplete until it is covered by another control. <\/li><\/ol><p>You don\u2019t need to start this work from scratch. iComply provides pre-built mappings between the supported frameworks; your job is to validate and supplement them. <\/p><h2 id=\"personalizar\">Customised controls<\/h2><p>In addition to the official libraries, you can create your own controls \u2014 whether to meet a client\u2019s contractual requirements, comply with internal policy or adhere to sector-specific legislation. A custom control behaves exactly like any other: it accepts evidence, is included in audits and can be mapped to requirements. <\/p><p>Recommendation: before creating a new control, check whether one already exists that covers the same measure. Libraries bloated with near-duplicate controls are the main reason why governance programmes become impossible to maintain. <\/p><h2 id=\"risco\">Linking controls to risks<\/h2><p>In <code>Risco \u2192 Registo<\/code>, match each risk with the controls that mitigate it. This has two important effects: <\/p><ul><li><strong>Calculated residual risk<\/strong> \u2014 the inherent risk is reduced on the basis of the effectiveness of the associated controls, rather than being estimated manually.<\/li><li><strong>Automatic prioritisation<\/strong> \u2014 when a control fails, the risks that depend on it are immediately flagged, showing where to take action first.<\/li><\/ul><h2 id=\"cadencia\">Frequencies and continuous guarantee<\/h2><p>A one-off check is like a snapshot; when carried out regularly, it is a vital indicator. Set the review frequency according to the level of criticality \u2014 monthly for privileged access, annually for a top-level policy. When the date arrives, the platform notifies the person in charge, the status changes to \u2018Under review\u2019 and the dashboard reflects this.  <\/p><p>It is this mechanism that replaces the frantic rush in the weeks leading up to the audit with a stable working routine.<\/p><h2 id=\"boas-praticas\">Best practice<\/h2><ul><li><strong>One check, one measurement.<\/strong> If the description of the control contains \u2018and\u2019 several times, there are probably two controls.<\/li><li><strong>Set out operational controls, not aspirational ones.<\/strong> &#8220;MFA required for all remote access&#8221; is auditable; &#8220;strengthen access security&#8221; is not.<\/li><li><strong>Always appoint a specific person to be responsible.<\/strong> Controls with no owner are not executed.<\/li><li><strong>Do not force mappings.<\/strong> Marking a requirement as satisfied when the control only partially addresses it creates a false sense of security and is detected during an audit.<\/li><li><strong>Review the library once a year.<\/strong> Remove any duplications and controls that are no longer applicable.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-24e2b3a e-con-full max_w_280 e-flex e-con e-child\" data-id=\"24e2b3a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f0d2d75 elementor-widget__width-inherit elementor-widget elementor-widget-table-of-contents\" data-id=\"f0d2d75\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;headings_by_tags&quot;:[&quot;h2&quot;],&quot;exclude_headings_by_selector&quot;:[],&quot;marker_view&quot;:&quot;bullets&quot;,&quot;icon&quot;:{&quot;value&quot;:&quot;&quot;,&quot;library&quot;:&quot;&quot;},&quot;min_height&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:0,&quot;sizes&quot;:[]},&quot;min_height_tablet_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"table-of-contents.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-toc__header\">\n\t\t\t\t\t\t<h4 class=\"elementor-toc__header-title\">\n\t\t\t\tOn this page\t\t\t<\/h4>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div id=\"elementor-toc__f0d2d75\" class=\"elementor-toc__body\">\n\t\t\t<div class=\"elementor-toc__spinner-container\">\n\t\t\t\t<svg class=\"elementor-toc__spinner eicon-animation-spin e-font-icon-svg e-eicon-loading\" aria-hidden=\"true\" viewBox=\"0 0 1000 1000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M500 975V858C696 858 858 696 858 500S696 142 500 142 142 304 142 500H25C25 237 238 25 500 25S975 237 975 500 763 975 500 975Z\"><\/path><\/svg>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b55ddaf e-con-full e-flex e-con e-child\" data-id=\"b55ddaf\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6eb2514 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"6eb2514\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">See the mapping in action<\/div><p class=\"elementor-image-box-description\">We\u2019ll show you a real-world example of a control that complies with six frameworks at the same time.\n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3f049d0 elementor-align-justify elementor-widget__width-inherit elementor-widget elementor-widget-button\" data-id=\"3f049d0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/icomply.pt\/en\/contact\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Book a demonstration<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0f76a6e e-flex e-con-boxed e-con e-parent\" data-id=\"0f76a6e\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2563e71 elementor-widget elementor-widget-heading\" data-id=\"2563e71\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Continue reading\n<\/h3>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8de8cf1 e-con-full e-grid e-con e-child\" data-id=\"8de8cf1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<a class=\"elementor-element elementor-element-0088d22 e-con-full e-flex e-con e-child\" data-id=\"0088d22\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/evidence-audits\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-deb8beb elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"deb8beb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Evidence &amp; audits<\/div><p class=\"elementor-image-box-description\">Collect reusable evidence and carry out audit and CAPA workflows.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-cb1e51c e-con-full e-flex e-con e-child\" data-id=\"cb1e51c\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/governance-domains\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-53bee08 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"53bee08\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Governance domains<\/div><p class=\"elementor-image-box-description\">Configure Security, Privacy, AI and all other areas.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-6b63f52 e-con-full e-flex e-con e-child\" data-id=\"6b63f52\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/api-integrations\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d761b28 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"d761b28\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">API &amp; integrations<\/div><p class=\"elementor-image-box-description\">REST API, webhooks and integrating iComply with your stack.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Documentation \/ Controls &amp; mapping Key concept \u00b7 14 mins Controls &amp; mapping Map a control once and reuse it across all frameworks. This is the concept that sets iComply apart from any checklist \u2014 it\u2019s worth understanding it properly. Most compliance tools organise work by framework: one list for ISO 27001, another for the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":2895,"menu_order":3,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_ice_seo_score":0,"_ice_review":"","footnotes":""},"class_list":["post-3421","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/comments?post=3421"}],"version-history":[{"count":14,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3421\/revisions"}],"predecessor-version":[{"id":3752,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3421\/revisions\/3752"}],"up":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/2895"}],"wp:attachment":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/media?parent=3421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}